Ledger says an unauthorized component installed in some devices sold by Southeast Asian reseller CryptoBilis captured users' 24-word recovery phrases and transmitted them over a cellular network. The company described the incident as a physical supply-chain attack rather than a compromise of Ledger software or internal systems.
The implant reportedly watched information displayed during wallet setup and used an embedded mobile connection to send it out. A recovery phrase can recreate the wallet's private keys, so anyone who obtains it can move the assets without possession of the device.
Why authenticity checks were not enough
Ledger's secure element, the chip that protects keys and verifies the device, remained intact in the affected units. The Record reported that this could allow a tampered device to pass normal authenticity checks even though an additional malicious component had been installed.
That finding changes the risk model. Software verification can confirm that a legitimate security chip is present, but it may not detect separate hardware placed between the screen and other components. The attack targeted what the user saw and recorded during initialization.
Ledger said confirmed cases involved devices sold through CryptoBilis and that it was investigating where the alteration occurred. The company did not describe the event as affecting devices bought through all channels. That limitation matters because a reseller-specific supply-chain breach is different from a flaw in every Ledger product.
What affected owners should do
Ledger advised customers who have not initialized a CryptoBilis device to stop and avoid entering a recovery phrase. Customers who already used one were told to transfer assets to a new wallet created on a trusted device with a newly generated phrase.
A replacement device alone is insufficient if the same recovery phrase is restored, because the exposed phrase remains valid. The safe migration requires a new phrase and on-chain transfers to addresses derived from it.
The incident is a reminder that hardware wallets reduce online attack exposure but do not eliminate vendor and distribution risk. Buyers should use authorized channels, inspect packaging and treat any device that requests unusual setup steps as compromised. The next useful disclosures are the affected models, sale dates, number of confirmed units and where the implants entered the supply chain.